# zn-gate for OpenCode

Install zn-gate for OpenCode: a small plugin that blocks reads of .env files with values and credential files, scrubs every tool's output and blocks secrets pasted into prompts.

Source: https://usezn.com/docs/install/opencode/

You need Node.js 18 or later. Paste each line in a terminal and press Enter after each one:

```bash
npm install -g zn-gate
zn hooks install opencode
```

zn-gate installs a small OpenCode plugin. Then restart OpenCode.

## What you get

- Reads of `.env` files with values, credential files and `~/.zn` are blocked in every tool.
- Every tool's output is scrubbed before the model sees it, and so is the preview in the terminal interface.
- A secret pasted into a prompt is blocked (OpenCode shows it as an error).
- If the zn plugin cannot run, calls and messages are blocked.

## Limits

- Not tested on Windows.
- `zn-gate check` confirms zn's rules for OpenCode but does not start OpenCode.

## Keep your .env values in the vault

The agent cannot read `.env` files with real values. Move the values into zn-gate's encrypted vault, and the file keeps markers such as `__ZN_STRIPE_KEY__`:

```bash
zn unlock            # creates the vault the first time
zn env shadow .env
```

After this your own app also reads the markers: start it with zn-gate's run command once you allow it. `env shadow` tells you how to undo it. More: [the vault](https://usezn.com/docs/quickstart/#2-keep-your-env-values-in-the-vault).

## Check that it works

In a new terminal, run `zn-gate check`. It should show **OK** for OpenCode. [What the output means](https://usezn.com/docs/check/).